Skip to content
ENExplore Calculators

Token Expiry Window Calculator

Work out token expiry window instantly with clear inputs, formula shown and shareable results.

About Token Expiry Window Calculator

Access token lifetime bounds the damage from a stolen bearer token, because a JWT cannot be revoked without central state — it simply stays valid until it expires. Short lifetimes of 5 to 15 minutes are the standard mitigation, with a long-lived refresh token held more securely and subject to rotation and reuse detection so that theft is at least detectable.

Formula

Exposure window

replayable requests = access token lifetime x request rate; refreshes per day = 1440 / access token minutes

Worked example

With the default values below, Token Expiry Window Calculator returns Requests a stolen access token could make of 75,000. Change any input above and every figure here is recalculated in your browser.

Inputs used

Access token lifetimeaccepts 1–1,440 min
15 min
Refresh token lifetimeaccepts 1–365 days
30 days
Authenticated requests per minuteminimum 1
5,000

Results

Requests a stolen access token could make
75,000
Token refreshes per session per day
96.0
Refresh token exposure window
30 days
Design trade-off
Short access token limits replay to a small window at the cost of frequent refreshes

Step by step

  1. 1Values used
  2. 2Exposure window
  3. 3Requests a stolen access token could make= 75,000
  4. 4Token refreshes per session per day= 96.0
  5. 5Refresh token exposure window= 30 days
  6. 6Design trade-off= Short access token limits replay to a small window at the cost of frequent refreshes

Assumptions and limits

  • The result is derived only from the 3 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 1 decimal place, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

Why not make access tokens long-lived for convenience?

Because they are bearer credentials that cannot be revoked. A token valid for 24 hours gives an attacker a full day of access after a single leak from a log or browser store.

What is refresh token rotation?

Each refresh issues a new refresh token and invalidates the old one. If an old token is presented again, that proves theft and the whole family can be revoked.

Related Calculators

Token Expiry Window Calculator | Calcrivo